XRP Ledger deploys upgrade after manifest flood exposed node vulnerability

XRP Ledger released xrpld 3.2.1 on July 31 after nodes were hit by a manifest flood that exposed a weakness in how validator manifests were handled. The ledger continued closing normally, with no confirmed fund losses and no consensus failure, but unpatched nodes remain exposed to resource-exhaustion risk until operators complete the upgrade. Ripple Director of Engineering Vijay Khanna issued an urgent call on August 1 and 2 for node operators to upgrade immediately, saying the release includes a hotfix that prevents the manifest flood attack. The attack exploited a gap that allowed nodes to accept, cache and rebroadcast unlimited manifests tied to unknown validator keys. The update adds four controls: oversized manifests are rejected, incoming batches are capped, data shared with new peers is limited, and the cache for unknown-key manifests is hard-limited to 100 entries. Unknown validator manifests are also no longer written to disk. Operators are required to follow a two-step process: install 3.2.1, let the server run for one to two minutes, then restart again to clear retained pre-patch data. Ripple also said systems should trust its current GPG signing key, rotated on February 18, 2026, or automatic upgrades may fail silently. The issue affects exchanges, custodians, wallet back ends, data providers and any business running its own XRPL server; ordinary XRP holders do not need to move funds or change keys.